Serverless and App Service Security on Azure
summary
A demo application serves a single‑page app from Blob static website, calls an HTTP‑triggered Azure Functions API that reads/writes Azure Table Storage, then evolves from a static function key to Azure AD OAuth tokens acquired with ADAL.js and validated as JWTs. API Management is inserted (consumption tier) to validate tokens, enforce CORS and rate limits and hide the function key. Roles are added via the app manifest and role claims used for authorization, and secrets move to Key Vault with a Managed Identity for the function. The demo runs end‑to‑end.
AI-written summary · about
chapters (8)
- 0:00Start
- 4:18Key Takeways about Serverless
- 4:59Amazon's Shared security responsibility
- 7:48App Sec Practices
- 9:54Typical Serverless Architecture
- 11:34Quick Demo
- 20:47Simplified OAuth Diagram
- 23:02Implicit Grant Flow
related talks
47mSecuring Serverless Applications in Azure
01h 00mSecuring Serverless Applications in Azure
50mSecuring Serverless Applications in Azure
01h 05mBuilding Secure Microservices in Azure
01h 02mDemystifying Web API Security in Azure
50mSecuring a REST API with Azure Active Directory
01h 01mAzure Network Security
01h 03mBuilding Secure Microservices in Azure